From: Qasim Ijaz <qasdev00@gmail.com>
To: nbd@nbd.name, lorenzo@kernel.org, ryder.lee@mediatek.com,
shayne.chen@mediatek.com, sean.wang@mediatek.com,
matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com,
chui-hao.chiu@mediatek.com, Bo.Jiao@mediatek.com
Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org
Subject: [PATCH] wifi: mt76: mt7996: avoid potential null deref in mt7996_get_et_stats()
Date: Sat, 22 Mar 2025 14:19:10 +0000 [thread overview]
Message-ID: <20250322141910.4461-1-qasdev00@gmail.com> (raw)
Ensure phy->mib is only accessed after the null sanity check for phy
otherwise the code may trigger a potential null deref.
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 88e013577c0d..19391966ee3e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1875,7 +1875,7 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
struct mt7996_dev *dev = mt7996_hw_dev(hw);
struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
struct mt7996_phy *phy = mt7996_vif_link_phy(&mvif->deflink);
- struct mt76_mib_stats *mib = &phy->mib;
+ struct mt76_mib_stats *mib;
struct mt76_ethtool_worker_info wi = {
.data = data,
.idx = mvif->deflink.mt76.idx,
@@ -1886,6 +1886,8 @@ void mt7996_get_et_stats(struct ieee80211_hw *hw,
if (!phy)
return;
+ mib = &phy->mib;
+
mutex_lock(&dev->mt76.mutex);
mt7996_mac_update_stats(phy);
--
2.39.5
next reply other threads:[~2025-03-22 14:21 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-22 14:19 Qasim Ijaz [this message]
2025-03-22 14:55 ` [PATCH] wifi: mt76: mt7996: avoid potential null deref in mt7996_get_et_stats() Markus Elfring
2025-03-22 15:54 ` Johannes Berg
2025-03-23 11:59 ` James Dutton
2025-03-24 5:50 ` Dan Carpenter
2025-03-24 7:33 ` Markus Elfring
2025-03-24 7:43 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250322141910.4461-1-qasdev00@gmail.com \
--to=qasdev00@gmail.com \
--cc=Bo.Jiao@mediatek.com \
--cc=angelogioacchino.delregno@collabora.com \
--cc=chui-hao.chiu@mediatek.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo@kernel.org \
--cc=matthias.bgg@gmail.com \
--cc=nbd@nbd.name \
--cc=ryder.lee@mediatek.com \
--cc=sean.wang@mediatek.com \
--cc=shayne.chen@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.